PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46070 Linux CVE debrief

A vulnerability in the Linux kernel's RAID5/RAID6 cache (r5c) and log (r5l) journal recovery code could allow out-of-bounds reads when processing corrupted journal metadata. The functions `r5c_recovery_analyze_meta_block()` and `r5l_recovery_verify_data_checksum_for_mb()` failed to validate on-disk payload size fields against the remaining space in metadata blocks before iterating over payloads. A corrupted journal with payload sizes extending beyond PAGE_SIZE boundaries could trigger out-of-bounds reads when accessing payload fields or computing offsets. The fix adds bounds validation for each payload type to ensure the full payload fits within meta_size before processing. This vulnerability affects systems using md/raid5 with journaling enabled. The issue was resolved in the Linux kernel stable branches with commits addressing the missing validation checks.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-24
Advisory published
2026-05-27
Advisory updated
2026-06-24

Who should care

System administrators managing Linux servers with software RAID5/RAID6 configurations using kernel-level journaling, particularly those in high-availability storage environments where RAID array integrity is critical

Technical summary

The vulnerability exists in the Linux kernel's RAID5/RAID6 cache (r5c) and log (r5l) journal recovery implementations. When recovering from a corrupted journal, the functions `r5c_recovery_analyze_meta_block()` and `r5l_recovery_verify_data_checksum_for_mb()` iterate over payload entries in metadata blocks using size fields read directly from disk without validation. A malicious or corrupted journal with oversized payload size fields could cause the kernel to read beyond allocated buffer boundaries (PAGE_SIZE), resulting in out-of-bounds memory access. The fix implements bounds checking to ensure each payload's claimed size fits within the remaining metadata block space before processing, preventing the out-of-bounds read condition.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from your Linux distribution that include the fixes for CVE-2026-46070
  • Verify that systems using md/raid5 with journaling (write-intent bitmap or journal device) are running patched kernel versions
  • Monitor kernel logs for RAID array recovery events that may indicate journal corruption attempts
  • Consider implementing filesystem-level integrity monitoring for critical RAID configurations
  • Review backup and recovery procedures for systems relying on md/raid5 arrays

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. Technical details confirmed through kernel.org git commit references. The issue was resolved via multiple stable kernel commits adding bounds validation for payload processing in r5c and r5l recovery functions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46070 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46070

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46070 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46070

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/33698bd1b2db9764a29df7751533d33967ff5c98

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/406aa86394ead347c47428fb51b6359bdaa2257d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/73ce72edd113374801045924d4417199963f73a3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b0cc3ae97e893bf54bbce447f4e9fd2e0b88bff9

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c3a1cf78bd1bbb51b2cc5189b4743056553c1e0e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.